Zero-Knowledge Architecture
Understanding how Agency protects your privacy.
The Trust Boundary
Agency implements a clear trust boundary:
Trusted Zone (Your Device)
- All document processing
- AI inference and embeddings
- Search index and knowledge graph
- Encryption/decryption operations
Untrusted Zone (External)
- Optional encrypted cloud sync and share links
- No plaintext ever crosses the boundary
How It Works
Local Processing
- Documents are processed entirely on your device
- Text extraction, OCR, and AI analysis happen locally
- Search indexes are stored encrypted on disk
Encryption
- XChaCha20-Poly1305 for data at rest and in sync bundles
- Argon2id + HKDF to derive keys from your passphrase
- Filenames are encrypted and hex-encoded before any sync
- Keys never leave your device; team/org keys stay local
Optional Cloud Sync
When enabled:
- Data is encrypted before leaving your device
- Cloud provider only sees encrypted blobs and encrypted filenames
- Works with App-Managed storage or BYOS buckets; keys stay local
- You maintain exclusive key control
Key Hierarchy (Zero-Knowledge by Design)
- Per-file Content Encryption Keys (CEKs) encrypt file content and previews.
- CEKs are wrapped by Team Keys; Team Keys are wrapped for each user.
- Privacy Mode keeps org admins out of team keys; Compliance Mode escrows keys for oversight.